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(57)Abstract: 

PROBLEM TO BE SOLVED: To provide a 
method for allowing even a general user who 
lacks technical knowledge about a network to 
easily realize the packet filtering condition 
setting of a network repeater system based on 
profile information. 

SOLUTION: This is a method for allowing a 
profile server 100 arranged on the Internet 1 to 
distribute the latest profile information to a 
network repeater system 20 by using an 
electronic mail function. The network repeater 
system 20 is allowed to periodically access to the 
profile server 100, and to acquire desired profile 
information as the attached file of the electronic 



mail. 
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[Claim(s)] 

[Claim 1]A profile distribution method characterized by comprising the following for 
distributing profile information required for a packet-filtering function from a server 
connected to a network to network equipment connected to the network concerned. 
A step which connects said network equipment with a predetermined communications 
protocol to said server which manages said profile information. 

A step which extracts and acquires desired profile information from profile information 
transmitted from said server. 

[Claim 2] Said network equipment is network repeating installation which has a relay 
function of installed user terminals and a network, and said profile information is used 
for it, The profile distribution method according to claim 1 constituting so that a 
packet-filtering function to said installed user terminals may be realized. 
[Claim 3]The profile distribution method according to claim 1 which said server is a 
mail server connected to the Internet, and is characterized by being constituted so that 
said profile information may be distributed by an electronic mail function which uses 
Internet Protocol. 

[Claim 4] Said server distributes list information which presents profile information of a 
distribution object by an electronic mail function, The profile distribution method 
according to claim 1 constituting so that profile information by which the selection 
request was carried out from the list information concerned may be distributed as an 
attached file of an E-mail. 

[Claim 5]Network repeating installation which has a relay function of installed user 
terminals and a network, comprising: 

A means to access on condition of predetermined to a server which is connected to a 
network and manages profile information required for a packet-filtering function. 
A means to extract and acquire desired profile information from profile information 
transmitted from said server, and a means to notify said acquired profile information to 
said installed user terminals. 

[Claim 6] Said server is a mail server connected to the Internet, and said acquisition 
means, The network repeating installation according to claim 5 constituting so that said 
profile information distributed as an attached file of an E-mail by electronic mail 
function which uses Internet Protocol by said server may be acquired. 
[Claim 7] Said server has a means to distribute list information which presents profile 
information of a distribution object by an electronic mail function, and receives said list 
information, The network repeating installation according to claim 5 or 6 having further 
a means to choose desired profile information from the list information concerned, and 
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to require of said server. 

[Claim 8]A network system which distributes profile information required for a 
packet-filtering function to network equipment connected to the network concerned by a 
server connected to a network, comprising: 
A means to accumulate the newest profile information. 

A means to distribute said profile information to said network equipment with a 
predetermined communications protocol. 

[Claim 9] The network system according to claim 8 which said server is a mail server 
connected to the Internet, and is characterized by being constituted so that said profile 
information may be distributed as an attached file of an E-mail by an electronic mail 
function which uses Internet Protocol. 

[Claim 10]The network system according to claim 8 or 9, wherein said server is further 
provided with a means to distribute list information which presents profile information 
of a distribution object by an electronic mail function. 



DETAILED DESCRIPTION 



[Detailed Description of the Invention] 
[0001] 

[Field of the Invention] This invention relates to the art of realizing the packet-filtering 
function for a general user's information protection especially, about the profile 
distribution method applied to networks, such as the Internet. 
[0002] 

[Description of the Prior Art]In recent years, the terminal equipment which can access 
alone at the Internet not only a personal computer (PC) but into a cellular phone, mobile 
information terminals (PDArPersonal Digital Assistant), etc. (connection) is developed. 
Such a terminal equipment has an Internet Protocol (IP) communication function, and 
enables offer of the network environment in a personal level via the Internet. 
[0003] As PC 10 and PDAll are shown in drawing 6 . access to the Internet 1 is attained 
via the line networks 40, such as the network repeating installation 60, such as a router, 
and ISDN, and Internet Service Provider (ISP) 30. ISP30 consists of WEB servers and is 
building what is called WWW (World Wide Web) with other WEB servers 200 connected 
to the Internet 1. 

[0004]The security function for avoiding disclosure, destruction, etc. of personal 
information by the attack and unauthorized entry from the Internet in terminal 
equipments (it is named a user terminal generically below) linked to the Internet, such 
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as PC10 and PDAll, is important. The packet-filtering function for preventing the 
inaccurate packet (IP packet) from the Internet in this security function is common 
knowledge. 

[0005]A packet-filtering function is a function (penetration determining function of a 
packet) which is provided, for example in the network repeating installation 60, such as 
a router, and controls the propriety of passage of a packet based on the IP header 
information on a packet, including IP address etc. 
[0006] 

[Problem(s) to be Solved by the Invention]As mentioned above, the newest 
packet-filtering function for protecting a user's information is provided in the network 
equipment linked to the Internet. However, since the art of the attack from the Internet 
aiming at disclosure, destruction, etc. of personal information is also rapid progress, in 
order to cope with a new attack, renewal of a packet-filtering function is indispensable. 
[0007]Roughly, as shown in drawing 7 . a packet-filtering function here, It is the function 
to judge the propriety of passage of the packets (e-mail, WWW, FTP, etc.) transmitted 
from certain PC10A with the network repeating installation 60, such as a router, and to 
perform a penetration (relay) or interception (abandonment) of the packet concerned. 
The network repeating installation 60 controls a penetration or interception of a packet 
based on the IP address (a transmission source address and transmission destination 
address) included in the IP header information on a packet. 

[0008] In recent years, the network repeating installation 60 has realized the 
packet-filtering function using the profile information which summarized as a definition 
file what described the definition for every various packets as determination 
information (filtering conditioning information) for judging the propriety of passage of a 
packet. Various kinds of methods are proposed as a method of creating this profile 
information (see JP,9-233113,A). 

[0009]As mentioned above, in order to update a packet-filtering function, it is necessary 
to update profile information and to change the packet-filtering conditioning of the 
network repeating installation 60. However, the updating operation concerned is 
complicated and it is difficult for a general user deficient in a network know how. 
[0010]Then, even if the purpose of this invention is a general user deficient in a network 
know how, there is in providing how the packet-filtering conditioning of network 
repeating installation is easily realizable based on profile information. 
[0011] 

[Means for Solving the Problem] Especially this invention relates to a way 
packet-filtering conditioning of network repeating installation (for example, router) to 
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which each user terminal is connected is easily realizable, about a distribution method 
of profile information which used an electronic mail function on the Internet. 
[00 12] Specifically, the 1st viewpoint of this invention is a profile distribution method for 
distributing profile information required for a packet-filtering function from a server 
connected to networks, such as the Internet, to network repeating installation 
connected to the network concerned. Network repeating installation receives profile 
information from a server by an electronic mail function, and extracts and acquires 
desired profile information. 

[0013]With such composition, the network repeating installation can access a server (a 
profile server or a mail server) which provides profile information periodically, for 
example, and can acquire the newest profile information by an electronic mail function. 
And the network repeating installation can change packet-filtering conditioning by 
setting up desired profile information according to directions from a user eventually. If 
it puts in another way, network repeating installation will become possible [ updating a 
packet-filtering function almost automatically ]. 

[0014]The 2nd viewpoint of this invention functions as a mail server connected to the 
Internet, and is related with a server which distributes profile information to network 
repeating installation on the Internet as an attached file of an E-mail by an electronic 
mail function. 

[00 15] With such composition, the Internet business model which realizes a kind of 
Internet Service Provider (ISP) who manages a profile server which distributes profile 
information can be provided. That is, service operations of special ISP which prepares 
profile information which specifies a packet-filtering function for every applications of 
various kinds of, for example, and provides it by E-mail to network repeating 
installation of demand- demanded profile information origin, or general ISP are 
realizable. 
[0016] 

[Embodiment of the Invention] With reference to drawings, an embodiment of the 
invention is described below. 

[00 17] (System configuration) Drawing 1 is a block diagram showing the important 
section of the network system related to this embodiment. 

[0018]According to the embodiment, PC(they may be two sets for convenience) 10A 
which is tens of sets of user terminals, for example, and 10B assume the system 
connected to the network repeating installation (specifically router etc.) 20. As a user 
terminal, not only PC but portable terminal equipment, such as a cellular phone and 
PDA, is contained. As for the Internet repeating installation 20, access to the Internet 1 
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is attained, for example via the line network 40 and Internet Service Providers (ISP) 30, 
such as ISDN. ISP30 consists of WEB servers and is building WWW (World Wide Web) 
with other WEB servers 200 connected to the Internet 1. 

[0019]Here, in the embodiment, the mail server called the profile (PF) server 100 for 
convenience is formed on the Internet 1. The PF server 100 performs processing which 
distributes the profile information for performing filtering conditioning in a 
packet-filtering function using an electronic mail function so that it may mention later. 
[0020] (Profile information) As profile information was mentioned above, the network 
repeating installation 20 summarizes as a definition file what described the definition 
for every various packets as determination information (filtering conditioning 
information) for judging the propriety of passage of a packet. Profile information 
consists of information which directs IN/OUT of transmitting agency and address 
(transmission destination) IP address, and transmitting origin and a destination port 
number (range), a protocol, filter operation (a penetration or interception), and a packet, 
as specifically shown in drawing 2 . A transmitting agency and destination IP addresses 
mean the application which a user uses so that the packet which is the target of filtering 
(a penetration or interception) may be specified and mentioned later. A port number and 
a protocol (here TCP) are the information for controlling communication of specific 
application. Here, the port number to be used may not restrict application in one, but 
two or more continuous port numbers may be used for it. In the network repeating 
installation 20 of the embodiment, a LAN side port and the WAN side port (Internet 
side port) are provided. In this case, setting out of a port number enables it to control 
communication of an IP packet to each of a LAN side port and the WAN side port. 
[0021] The profile information shown in drawing 2 is a definition file in the case of 
performing conditioning of two or more IP packet filtering, for example, is a TCP 
(Transmission Control Protocol) protocol, It is the information for making the packet of 
the application (A) which uses No. 4000, No. 5000, and No. 6000 simultaneously as a 
port number penetrate (passage). If it puts in another way, when the network repeating 
installation 20 sets up the profile information concerned, PC10A and 10B become 
possible [ using application (A) ], and can access the information by application (A) on 
the Internet 1. 

[0022] Here, in the former, as an IP packet is shown in drawing 5 , the header 
information which consists of IP header structure is established. According to a protocol, 
the header information which consists of TCP header structure corresponding to a TCP 
protocol and UDP header structure corresponding to an UDP (User Datagram Protocol) 
protocol is included. 
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[0023] (Profile distribution method) With reference to the flow chart of drawing 3 and 
drawing 4 , the profile distribution method of the embodiment is explained from drawing 
JLbelow. 

[0024]The network repeating installation 20 of the embodiment is periodical, or 
according to the directions from a user, the PF server 100 on the Internet 1 is accessed, 
and it acquires an E-mail (Step SI). The PF server 100 is a mail server which special 
ISP is managing, for example, and transmits PF list mail with what is called an e-mail 
service function. Here, the PF server 100 transmits the attached file of the mail which 
performed user authentication processing by the password and user ID which were 
enciphered as well as the usual electronic mail function, and was encoded for example, 
in BASE64 form. 

[0025]As PF list mail is specifically shown in drawing 3 (Ah a profile name, a login ID, a 
password, a use (here, the application A, B, and C specifies), etc. are described. The 
network repeating installation 20 shifts to the processing which acquires the file 
information concerned, when new profile information other than the existing profile 
information is registered from acquired PF list mail (YES of Step S2). 
[0026] The network repeating installation 20 reads a login ID and a password in 
acquired PF list mail, and logs in to the PF server 100 with the login ID concerned and a 
password (step S4). Then, the network repeating installation 20 downloads the E-mail 
transmitted from the PF server 100 concerned by checking the transmitting mail 
addressed to the user ID concerned from the PF server 100 (YES of Step S5). In not 
receiving an E-mail, it performs predetermined error handling (Step S7). 
[0027]The PF server 100 transmits the E-mail which has the profile information 
corresponding to the application (A) demanded from the network repeating installation 
20 as an attached file, as shown, for example in drawing 3 (B). The network repeating 
installation 20 develops the attached file of the downloaded E-mail, and the profile 
information (see drawing 2) corresponding to application (A) is extracted here (Step S6). 
[0028]Here, the user can check the profile information acquired from the network 
repeating installation 20, for example on a homepage by operating PClOAand 10B. It is 
determined whether the network repeating installation 20 applies the acquired profile 
information to a packet-filtering function according to the directions from a user. 
[0029]If it is a profile distribution method of the embodiment as mentioned above, the 
network repeating installation 20 connected to each user terminal, It is the newest 
profile information and the definition file which makes possible conditioning of two or 
more IP packet filtering can be acquired from the PF server 100 on the Internet 1 by the 
usual electronic mail function. Therefore, the user can realize easily conditioning of IP 
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packet filtering for using desired application (A), without doing special work. Thereby, 
especially the user using the Internet can update a packet-filtering function easily, 
without requiring the special knowledge about a network. 

[0030]If it puts in another way and will be a profile distribution method of the 
embodiment, the Internet business model which realizes a kind of Internet Service 
Provider (ISP) who manages the profile server which distributes profile information can 
be provided. Namely, the profile information which realizes the packet-filtering function 
which regulates the communication function for every applications of various kinds of, 
for example is prepared, The service operations of special ISP which provides the 
demanded profile information by E-mail to the network repeating installation of a 
requiring agency, or general ISP are realizable. 
[0031] 

[Effect of the Invention] As explained in full detail above, according to this invention, the 
newest profile information for realizing a packet-filtering function is acquirable from 
networks, such as the Internet, using a usual communications protocol like an 
electronic mail function. Therefore, even if it is a general user deficient in a network 
know how, based on profile information, the packet-filtering conditioning of network 
repeating installation is easily realizable. 



DESCRIPTION OF DRAWINGS 



[Brief Description of the Drawings] 

[Drawing l] The block diagram showing the important section of the network system 
about the embodiment of this invention. 

[Drawing 2] The figure showing an example of the file information about the 
embodiment. 

[Drawing 3] The figure for explaining the contents of e-mail in the profile distribution 
method about the embodiment. 

[Drawing 4] The flow chart for explaining the procedure of the profile distribution 
method about the embodiment. 

[Drawing 5] The figure for explaining the contents of the IP header information on the 
conventional packet. 

[Drawing 6] The block diagram for explaining the network system in the conventional 
Internet. 

[Drawing 7] The figure for explaining the conventional packet-filtering function. 
[Description of Notations] 
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I - Internet 

10A, 10B - Personal computer (PC) 

II - PDA 

20, 60 -- Network repeating installation 

30 - Internet Service Provider (ISP) 

40 — Line network 

100 » Profile (PF) server 

200 - WEB server 



* NOTICES * 

JPO and INPIT are not responsible for any 
damages caused by the use of this translation. 

1. This document has been translated by computer. So the translation may not reflect 
the original precisely. 

2. **** shows the word which can not be translated. 
3.1n the drawings, any words are not translated. 
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Mf-exT'D/V^' (I SP) 3 0^S*LT, -Y^ 
^-^y h l-^©r*-feX*»RrtBfc38:oTV"»*. I S P 
50 3 0l4WEBU--Mfre&D> ^MyH« 



5 

SftT^3ffi©WEB"9-w*2 0 0fc#fc, WWW (Wo 
rid Wide Web) SUSSLTVSa 

[0019] ecu, nrntmrnxHt, jy$-%v\> 

i±tt*, iMi;Wc7n7 7^/i/ (pf) ^-m oo 
[0020] (.yuyrjfrmw 7a 7 7 /MPS 

t, mimms^ mm) i ptfi^x, mii^ 

0«* o -F#^ ($BH) , ynhn;K 7^/l/*!j{t 
(jfilX&jUfr) RUW'y h© I N/0UT£^f 
3'l»$gfrP>&3o ^Bte&c/^I P7FPXH:, 7^f 

c T?ii tcp) a, #^7 7 u y-s/ 3 yommmm 

7-^4)||g«2 0T&. L A Nl!I*°- r- fcWA NfU# 
-h (Jy$-%v hi!l^-h) »5tl5. C©JI 
£\ #-h##0t8££J:»?, LANil^-hfcWAN 
flU^-hO^n^nfcWLTs I P/1-r-y r-©jHa£f!I 

[0 0 2 l ] m 2 fc^f 7a 7 r-f ;WWIH:, «»o I 
P/^7b7-f;^'Jy ^ o*ftBBE*fr 5 if ^©£« 

77^/l7t s &tK 0>J*.fcfTCP (Transmission Control 
Protocol) 7°n h- X)VT\ r-#^£: LT 4 0 0 0 
#, 5000#, 6 0 0 OS^IH^fc^fflf 577'y^ 
— >a> (A) ©/^<y h^jtJl GffiD £•&§£&© 

^M7 , n7 7-r;Hf|g*^1-^cfc}!:J:Ds PC 10 

a, i omtryvr-ysy (a) fcflyrrscfctf 

(A) fccfc31i$g©7^x£ft5<i£;&n?ts 0 

[0 0 2 2] IP^^Kt 05 

W-6tiTV»5. Sfcx 7nhD;Wc^oT, TCP7n 
r- 3;l/fcftf&f S TCP'N'y #RiEW\ UDP (User D 
atagram Protocol) 7n h H/WeftjSf § UDP^'j/? 

[002 3] (7 , n7rW7l>EflRrffi) WTHlfrfeH 

3s.L/H4(T)7D-^^-h^#siLT, nmsiRo 
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7n 7 7 -Y ;l/iBM^j* ^ms^-r § „ 

[0024] mmmmmcDZ-v Yy-z^wmmz o 

*y M±©P F1f-m 0 0t7^«U 

i^mwt^ Ufyys i) o PF^iooit, 
i s p^MMbTv^^-^-^-eso, 

^b*S*F*-;l/lJ---i£X«|&fc .to P F U7h^— 
Jl/fcStMf So C CT% P F *!r—>\ 1 0 0 \ts im<Dm 
^-;Mltii:H1f ^ Hf^fb?nfc^X7- F^a- 
10 if I DtJ;§ a-ifBEft«**ff U i- fc«*fcf B A 
S E 6 4ff^-ex^3-FSn/c^-;KD?i#7 7^;V 

[0 0 2 5] PF'J7h^-M, M<*Wttig|3 
(A) Kmt&olz, yn77"f;l/«, d^vid, 
Rtffflji (clCl-c s «77 , 'J'T-^3yA, 
B, C©f|© ftEtfEaStVCVS. ^7h7-^^ 
H8B2 0«, LfcP F >J*b*-;l/fr5, g£#© 
7n 7 r ^;M«BKno*f U^n 7 r-f ;W*tf S» 

20 gPffTS (Xf77*S2©YES) „ 

[0 0 2 6] *y b7-^*«SHl2 014, L/fcP 

F'JXh^-;Vi^n^yiD, ^X7-F£HB|x 

Sin^VyiD, /U7-F£iDPFt-;q 
OOtn^Vvrs (X'r>y7°S4) „ com, *-yh 
7-^«SB2 0tt, P F+r-^1 0 OfrP^SP— 
If I Dj6cD^-;Ma6fll«flBK1-*cfcfcJ:t>x S^P F 
if-^ 1 0 0^5MfiStiS«?^-;l/^^7yn-F 
f« Uf77S 50YE S) „ &43, m=?^~)l^ 

30 -y7S 7) o 

[0 0 2 7] PFif-m0 0t±, MX.tfB93 (B) (c 
^■Td;5fc, *y h7-^cfl|gg2 O^SSsft^tlfc 

77U7-i/ay (A) fc*H6r*yn7r-f;MWI* 
?ift77-r;Vi:bTWrsm?^-;b*5iii-rSc *y 

(A) tc^jS-r^7 , D77-f;Hffg (H2^#F,i) 

w-r* Ut77s 6) o 

[0 0 2 8] C£T\ a— imPC 1 OA, lOBSjft 
40 ffT3oi;{;:£i9, F7-^«Sg2 0^6Wf 

Lfc7n 7 7^)vmm%, mm^-h^-^j^nm 

[0 0 2 9] JM±OJ;5fcWI3ttBP»o^a7r>r;VE 

^«aS2 0ti % ^y^7MiOPF1J-wq 
0 0^5, gff O 7n 7 7 ^ MfflTilb <D , «»o I P 

50 /^r-y b7*)v$vyy<D&{$m%.mm£t5mm7 



7 

for, ^-^tmmmmio ^ < , 

CD7yj^->'3y (A) mm?%>rc&(Dl P/^>y 

h 7 ^ /i^ y ^^o^^^^tc^-r § c t tf-z- 

[0 0 3 0] jfcwrtitf, W^»^©yn 7 r-f ;l/BB 

o/W^ (ISP) «3KSa*rs-f^^— *y M£$>*X 

3 >«OjlflMWIB«jawt"*/^y h7^/l/* <; 

n 7 r-f ;HBI*H*7BO* y h 7-^ ^ilSgt^f L 
T«?^-/Ke3f#tf §1^1 S PSfcttHftl s P© 

[0 0 3 1] 

BWioJIft*] «±1S£ L fe «k 9 fc#«u§K: <fc ntf, -f 20 
L^-$8ci-+f o T t, % 7n 7 r -f MBfBfcg^ 
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[0ffi©f8»ftmBJf] 

[0 l ] iJ^oSWBBftfcWra** M7-*->*t 

[B 2 ] n&ffigfftcN'rs 7 r f/Mf fflo-fllfcjSf 
Ho 

[03] B*M0g|fcBB'r87*n 7 T'f /I/E«*S*T?0 

[0 4 ] RKHfl^tMc m % 7d 7 r -f /VKfiTa ?£ 
)i^0J-T§fei&cD7n-^+- K 

[0 5] I P^y^'»$g<Dl^£IM0J3 

f §fcJ600 o 

[06] ^*£D^y^-^<y hT©^«y h7-^Xr 

[0 7 ] fBfcew y h 7 -r y y?Htl£iPJiT5 

fcJ6£D0 o 
[^©Sffi] 
1 *y h 

10A, i0B-^-vt;Vnyti°a-^ (PC) 
1 1-PDA 

2 0, 6 o-*>y hv-t^mmw 

3 O-^y^-^-y h-9— ex7n/W# (ISP) 

4 0-EMGM 

1 0 0-7*n77^;V (P F) -9--^ 

2 0 0--WE B+h-^ 



[01] 



[03] 



100 




20 
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' ? * 

40 




200 



[02] 



(A) 



(B) 



i£fS7cim'UX 




mm) 




rum 




IN/OUT 
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# 






4000 


4000 


* 


* 


TCP 




IN 








* 


5000 


5000 




* 


TCP 




IN 




* 


* 




6000 


6000 


* 


* 


TCP 




IN 



Subject : Profile Ust 

Profilet :vr^-i>3>A" 
Login 1 : "abetter 
Passwordl : "hk/?1kgh +" 
Profile2 ; "7ry^S»3>B" 
Login2:"gh!jklmn M 
Password2 : 1 asdfahkald" 
Profil&3 : Tm-y&C* 
Login3 : "opqrstu* 
Passwords : "tyqo75a1adba" 



Subject iTT'Jfr-frgVA 



* * * * ft * **** ** ** * ** * * 
******************* 
******************* 
*********** ******** 
******************* 
******************* 
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[04] 



[05] 




S4 




TCS 



TTL 



PADgg 



tcp gg£g8j ., 



Urgantfff>$ 

— 2£s> 



[H7] 



UPP»'fryhJ£ 



[me] 




IP tffc* 




IP 

(WWW) 
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IP *>,h 
(FTP) 



mm 



IP 




IP If** 
.(FTP) 
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